test: add full test coverage for notes, ues, ue-modules, ajustements, enseignements, users
- Unit tests (mock DB + API) for all missing endpoints - Integration tests (Drizzle direct) for all missing entities - E2E tests (handler + real DB) for all missing endpoints - Robustness tests: invalid inputs, SQL injection, type errors, business rule violations - Seed helpers: seedNotes, seedUeModules, seedEnseignements, seedAjustements - Add test:coverage and test:coverage:html tasks to deno.json Tests expose known handler bugs (marked [BUG] in test names): - ajustements PUT/DELETE: .where() without and() modifies all rows for student - Missing try/catch in modules, users, enseignements handlers - Whitespace accepted as valid string values - No type or business rule validation (note bounds, coeff >= 0)
This commit is contained in:
@@ -0,0 +1,301 @@
|
||||
// E2E tests for /ajustements endpoints — handler + real DB
|
||||
|
||||
import { assertEquals, assertExists } from "@std/assert";
|
||||
import {
|
||||
makeContextWithAffiliation,
|
||||
makeEmployeeContext,
|
||||
makeGetRequest,
|
||||
makeJsonRequest,
|
||||
} from "../helpers/handler.ts";
|
||||
import {
|
||||
seedAjustements,
|
||||
seedPromotions,
|
||||
seedStudents,
|
||||
seedUes,
|
||||
truncateAll,
|
||||
} from "../helpers/db_integration.ts";
|
||||
import { handler as ajustementsHandler } from "$apps/notes/api/ajustements.ts";
|
||||
import { handler as ajustementHandler } from "$apps/notes/api/ajustements/[numEtud]/[idUE].ts";
|
||||
import { ajustements as ajustementsTable } from "$root/databases/schema.ts";
|
||||
import { testDb } from "../helpers/db_integration.ts";
|
||||
|
||||
// --- GET /ajustements ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: GET /ajustements returns all",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Dupont", prenom: "Jean", idPromo: "P1" }]);
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
await seedAjustements([{ numEtud: s.numEtud, idUE: ue.id, valeur: 13.0 }]);
|
||||
const res = await ajustementsHandler.GET!(makeGetRequest("/ajustements"), makeEmployeeContext());
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 1);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: GET /ajustements?numEtud filters by student",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s1] = await seedStudents([{ nom: "Dupont", prenom: "Jean", idPromo: "P1" }]);
|
||||
const [s2] = await seedStudents([{ nom: "Martin", prenom: "Alice", idPromo: "P1" }]);
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
await seedAjustements([
|
||||
{ numEtud: s1.numEtud, idUE: ue.id, valeur: 13.0 },
|
||||
{ numEtud: s2.numEtud, idUE: ue.id, valeur: 15.0 },
|
||||
]);
|
||||
const res = await ajustementsHandler.GET!(
|
||||
makeGetRequest("/ajustements", { numEtud: String(s1.numEtud) }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 1);
|
||||
assertEquals(body[0].numEtud, s1.numEtud);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: GET /ajustements?numEtud=NaN returns 400",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementsHandler.GET!(
|
||||
makeGetRequest("/ajustements", { numEtud: "abc" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- POST /ajustements ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: POST /ajustements creates ajustement (201) as employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Leroy", prenom: "Paul", idPromo: "P1" }]);
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
const res = await ajustementsHandler.POST!(
|
||||
makeJsonRequest("/ajustements", "POST", { numEtud: s.numEtud, idUE: ue.id, valeur: 14.5 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 201);
|
||||
const body = await res.json();
|
||||
assertExists(body.numEtud);
|
||||
assertEquals(body.valeur, 14.5);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: POST /ajustements 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementsHandler.POST!(
|
||||
makeJsonRequest("/ajustements", "POST", { numEtud: 1, idUE: 1, valeur: 10.0 }),
|
||||
makeContextWithAffiliation("student"),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: POST /ajustements 400 on missing fields",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementsHandler.POST!(
|
||||
makeJsonRequest("/ajustements", "POST", { numEtud: 12345 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- GET /ajustements/:numEtud/:idUE ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: GET /ajustements/:numEtud/:idUE returns correct ajustement (employee)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s1, s2] = await seedStudents([
|
||||
{ nom: "Bernard", prenom: "Lucie", idPromo: "P1" },
|
||||
{ nom: "Dupont", prenom: "Jean", idPromo: "P1" },
|
||||
]);
|
||||
const [ue1, ue2] = await seedUes([{ nom: "UE Maths" }, { nom: "UE Info" }]);
|
||||
// Plusieurs lignes partageant numEtud=s1 — le handler doit discriminer par idUE
|
||||
await seedAjustements([
|
||||
{ numEtud: s1.numEtud, idUE: ue1.id, valeur: 16.0 },
|
||||
{ numEtud: s1.numEtud, idUE: ue2.id, valeur: 8.0 },
|
||||
{ numEtud: s2.numEtud, idUE: ue1.id, valeur: 12.0 },
|
||||
]);
|
||||
const res = await ajustementHandler.GET!(
|
||||
makeGetRequest(`/ajustements/${s1.numEtud}/${ue1.id}`),
|
||||
makeEmployeeContext({ numEtud: String(s1.numEtud), idUE: String(ue1.id) }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.valeur, 16.0);
|
||||
assertEquals(body.numEtud, s1.numEtud);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: GET /ajustements/:numEtud/:idUE 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementHandler.GET!(
|
||||
makeGetRequest("/ajustements/1/1"),
|
||||
makeContextWithAffiliation("student", { numEtud: "1", idUE: "1" }),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: GET /ajustements/:numEtud/:idUE 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementHandler.GET!(
|
||||
makeGetRequest("/ajustements/99999/99"),
|
||||
makeEmployeeContext({ numEtud: "99999", idUE: "99" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- PUT /ajustements/:numEtud/:idUE ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: PUT /ajustements/:numEtud/:idUE updates only targeted row (employee)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Thomas", prenom: "Eva", idPromo: "P1" }]);
|
||||
const [ue1, ue2] = await seedUes([{ nom: "UE Physique" }, { nom: "UE Chimie" }]);
|
||||
// Deux ajustements pour le même étudiant — seul ue1 doit être modifié
|
||||
await seedAjustements([
|
||||
{ numEtud: s.numEtud, idUE: ue1.id, valeur: 10.0 },
|
||||
{ numEtud: s.numEtud, idUE: ue2.id, valeur: 7.0 },
|
||||
]);
|
||||
const res = await ajustementHandler.PUT!(
|
||||
makeJsonRequest(`/ajustements/${s.numEtud}/${ue1.id}`, "PUT", { valeur: 19.0 }),
|
||||
makeEmployeeContext({ numEtud: String(s.numEtud), idUE: String(ue1.id) }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.valeur, 19.0);
|
||||
// ue2 doit rester intact
|
||||
const unchanged = await testDb.select().from(ajustementsTable);
|
||||
const ue2Row = unchanged.find((a) => a.idUE === ue2.id);
|
||||
assertEquals(ue2Row?.valeur, 7.0);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: PUT /ajustements/:numEtud/:idUE 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementHandler.PUT!(
|
||||
makeJsonRequest("/ajustements/1/1", "PUT", { valeur: 10.0 }),
|
||||
makeContextWithAffiliation("student", { numEtud: "1", idUE: "1" }),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: PUT /ajustements/:numEtud/:idUE 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementHandler.PUT!(
|
||||
makeJsonRequest("/ajustements/99999/99", "PUT", { valeur: 10.0 }),
|
||||
makeEmployeeContext({ numEtud: "99999", idUE: "99" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- DELETE /ajustements/:numEtud/:idUE ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: DELETE /ajustements/:numEtud/:idUE deletes only targeted row (employee)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Petit", prenom: "Hugo", idPromo: "P1" }]);
|
||||
const [ue1, ue2] = await seedUes([{ nom: "UE Chimie" }, { nom: "UE Bio" }]);
|
||||
// Deux ajustements pour le même étudiant — seul ue1 doit être supprimé
|
||||
await seedAjustements([
|
||||
{ numEtud: s.numEtud, idUE: ue1.id, valeur: 11.0 },
|
||||
{ numEtud: s.numEtud, idUE: ue2.id, valeur: 14.0 },
|
||||
]);
|
||||
const res = await ajustementHandler.DELETE!(
|
||||
makeGetRequest(`/ajustements/${s.numEtud}/${ue1.id}`),
|
||||
makeEmployeeContext({ numEtud: String(s.numEtud), idUE: String(ue1.id) }),
|
||||
);
|
||||
assertEquals(res.status, 204);
|
||||
// ue2 doit toujours exister
|
||||
const remaining = await testDb.select().from(ajustementsTable);
|
||||
assertEquals(remaining.length, 1);
|
||||
assertEquals(remaining[0].idUE, ue2.id);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: DELETE /ajustements/:numEtud/:idUE 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementHandler.DELETE!(
|
||||
makeGetRequest("/ajustements/1/1"),
|
||||
makeContextWithAffiliation("student", { numEtud: "1", idUE: "1" }),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ajustements: DELETE /ajustements/:numEtud/:idUE 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementHandler.DELETE!(
|
||||
makeGetRequest("/ajustements/99999/99"),
|
||||
makeEmployeeContext({ numEtud: "99999", idUE: "99" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
@@ -0,0 +1,185 @@
|
||||
// E2E tests for /enseignements endpoints — handler + real DB
|
||||
|
||||
import { assertEquals, assertExists } from "@std/assert";
|
||||
import {
|
||||
makeContextWithAffiliation,
|
||||
makeEmployeeContext,
|
||||
makeGetRequest,
|
||||
makeJsonRequest,
|
||||
} from "../helpers/handler.ts";
|
||||
import {
|
||||
seedEnseignements,
|
||||
seedModules,
|
||||
seedPromotions,
|
||||
seedUsers,
|
||||
truncateAll,
|
||||
} from "../helpers/db_integration.ts";
|
||||
import { handler as enseignementsHandler } from "$apps/admin/api/enseignements.ts";
|
||||
import { handler as enseignementHandler } from "$apps/admin/api/enseignements/[idProf]/[idModule]/[idPromo].ts";
|
||||
|
||||
// --- POST /enseignements ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: POST /enseignements creates enseignement (201) as employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([{ id: "prof.dupont", nom: "Dupont", prenom: "Jean" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const res = await enseignementsHandler.POST!(
|
||||
makeJsonRequest("/enseignements", "POST", { idProf: "prof.dupont", idModule: "M1", idPromo: "P1" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 201);
|
||||
const body = await res.json();
|
||||
assertExists(body.idProf);
|
||||
assertEquals(body.idModule, "M1");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: POST /enseignements 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await enseignementsHandler.POST!(
|
||||
makeJsonRequest("/enseignements", "POST", { idProf: "p", idModule: "M1", idPromo: "P1" }),
|
||||
makeContextWithAffiliation("student"),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: POST /enseignements 400 on missing fields",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await enseignementsHandler.POST!(
|
||||
makeJsonRequest("/enseignements", "POST", { idProf: "prof.dupont" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: POST /enseignements 409 on duplicate",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([{ id: "prof.dupont", nom: "Dupont", prenom: "Jean" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
await seedEnseignements([{ idProf: "prof.dupont", idModule: "M1", idPromo: "P1" }]);
|
||||
const res = await enseignementsHandler.POST!(
|
||||
makeJsonRequest("/enseignements", "POST", { idProf: "prof.dupont", idModule: "M1", idPromo: "P1" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 409);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- GET /enseignements/:idProf/:idModule/:idPromo ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: GET /enseignements/:idProf/:idModule/:idPromo returns enseignement (employee)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([{ id: "prof.dupont", nom: "Dupont", prenom: "Jean" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
await seedEnseignements([{ idProf: "prof.dupont", idModule: "M1", idPromo: "P1" }]);
|
||||
const res = await enseignementHandler.GET!(
|
||||
makeGetRequest("/enseignements/prof.dupont/M1/P1"),
|
||||
makeEmployeeContext({ idProf: "prof.dupont", idModule: "M1", idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.idProf, "prof.dupont");
|
||||
assertEquals(body.idModule, "M1");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: GET /enseignements/:idProf/:idModule/:idPromo 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await enseignementHandler.GET!(
|
||||
makeGetRequest("/enseignements/p/M1/P1"),
|
||||
makeContextWithAffiliation("student", { idProf: "p", idModule: "M1", idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: GET /enseignements/:idProf/:idModule/:idPromo 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await enseignementHandler.GET!(
|
||||
makeGetRequest("/enseignements/ghost/GHOST/GHOST"),
|
||||
makeEmployeeContext({ idProf: "ghost", idModule: "GHOST", idPromo: "GHOST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- DELETE /enseignements/:idProf/:idModule/:idPromo ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: DELETE /enseignements/:idProf/:idModule/:idPromo returns 204 (employee)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([{ id: "prof.dupont", nom: "Dupont", prenom: "Jean" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
await seedEnseignements([{ idProf: "prof.dupont", idModule: "M1", idPromo: "P1" }]);
|
||||
const res = await enseignementHandler.DELETE!(
|
||||
makeGetRequest("/enseignements/prof.dupont/M1/P1"),
|
||||
makeEmployeeContext({ idProf: "prof.dupont", idModule: "M1", idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 204);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: DELETE /enseignements/:idProf/:idModule/:idPromo 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await enseignementHandler.DELETE!(
|
||||
makeGetRequest("/enseignements/p/M1/P1"),
|
||||
makeContextWithAffiliation("student", { idProf: "p", idModule: "M1", idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e enseignements: DELETE /enseignements/:idProf/:idModule/:idPromo 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await enseignementHandler.DELETE!(
|
||||
makeGetRequest("/enseignements/ghost/GHOST/GHOST"),
|
||||
makeEmployeeContext({ idProf: "ghost", idModule: "GHOST", idPromo: "GHOST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
@@ -0,0 +1,244 @@
|
||||
// E2E tests for /notes endpoints — handler + real DB
|
||||
|
||||
import { assertEquals, assertExists } from "@std/assert";
|
||||
import {
|
||||
makeEmployeeContext,
|
||||
makeGetRequest,
|
||||
makeJsonRequest,
|
||||
} from "../helpers/handler.ts";
|
||||
import {
|
||||
seedModules,
|
||||
seedNotes,
|
||||
seedPromotions,
|
||||
seedStudents,
|
||||
truncateAll,
|
||||
} from "../helpers/db_integration.ts";
|
||||
import { handler as notesHandler } from "$apps/notes/api/notes.ts";
|
||||
import { handler as noteHandler } from "$apps/notes/api/notes/[numEtud]/[idModule].ts";
|
||||
|
||||
// --- GET /notes ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: GET /notes returns all notes",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Dupont", prenom: "Jean", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }, { id: "M2", nom: "Mod B" }]);
|
||||
await seedNotes([
|
||||
{ numEtud: s.numEtud, idModule: "M1", note: 15.0 },
|
||||
{ numEtud: s.numEtud, idModule: "M2", note: 12.0 },
|
||||
]);
|
||||
const res = await notesHandler.GET!(makeGetRequest("/notes"), makeEmployeeContext());
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 2);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: GET /notes?numEtud filters by student",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s1] = await seedStudents([{ nom: "Dupont", prenom: "Jean", idPromo: "P1" }]);
|
||||
const [s2] = await seedStudents([{ nom: "Martin", prenom: "Alice", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
await seedNotes([
|
||||
{ numEtud: s1.numEtud, idModule: "M1", note: 15.0 },
|
||||
{ numEtud: s2.numEtud, idModule: "M1", note: 12.0 },
|
||||
]);
|
||||
const res = await notesHandler.GET!(
|
||||
makeGetRequest("/notes", { numEtud: String(s1.numEtud) }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 1);
|
||||
assertEquals(body[0].numEtud, s1.numEtud);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: GET /notes?numEtud=NaN returns 400",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await notesHandler.GET!(
|
||||
makeGetRequest("/notes", { numEtud: "abc" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: GET /notes?idModule filters by module",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Dupont", prenom: "Jean", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }, { id: "M2", nom: "Mod B" }]);
|
||||
await seedNotes([
|
||||
{ numEtud: s.numEtud, idModule: "M1", note: 15.0 },
|
||||
{ numEtud: s.numEtud, idModule: "M2", note: 10.0 },
|
||||
]);
|
||||
const res = await notesHandler.GET!(
|
||||
makeGetRequest("/notes", { idModule: "M1" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 1);
|
||||
assertEquals(body[0].idModule, "M1");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- POST /notes ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: POST /notes creates note (201)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Leroy", prenom: "Paul", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
const res = await notesHandler.POST!(
|
||||
makeJsonRequest("/notes", "POST", { numEtud: s.numEtud, idModule: "M1", note: 14.0 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 201);
|
||||
const body = await res.json();
|
||||
assertExists(body.numEtud);
|
||||
assertEquals(body.note, 14.0);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: POST /notes 400 on missing fields",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await notesHandler.POST!(
|
||||
makeJsonRequest("/notes", "POST", { numEtud: 12345 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- GET /notes/:numEtud/:idModule ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: GET /notes/:numEtud/:idModule returns note",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Bernard", prenom: "Lucie", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
await seedNotes([{ numEtud: s.numEtud, idModule: "M1", note: 18.0 }]);
|
||||
const res = await noteHandler.GET!(
|
||||
makeGetRequest(`/notes/${s.numEtud}/M1`),
|
||||
makeEmployeeContext({ numEtud: String(s.numEtud), idModule: "M1" }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.note, 18.0);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: GET /notes/:numEtud/:idModule 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await noteHandler.GET!(
|
||||
makeGetRequest("/notes/99999/GHOST"),
|
||||
makeEmployeeContext({ numEtud: "99999", idModule: "GHOST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- PUT /notes/:numEtud/:idModule ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: PUT /notes/:numEtud/:idModule updates note",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Thomas", prenom: "Eva", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
await seedNotes([{ numEtud: s.numEtud, idModule: "M1", note: 10.0 }]);
|
||||
const res = await noteHandler.PUT!(
|
||||
makeJsonRequest(`/notes/${s.numEtud}/M1`, "PUT", { note: 16.0 }),
|
||||
makeEmployeeContext({ numEtud: String(s.numEtud), idModule: "M1" }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.note, 16.0);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: PUT /notes/:numEtud/:idModule 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await noteHandler.PUT!(
|
||||
makeJsonRequest("/notes/99999/GHOST", "PUT", { note: 10.0 }),
|
||||
makeEmployeeContext({ numEtud: "99999", idModule: "GHOST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- DELETE /notes/:numEtud/:idModule ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: DELETE /notes/:numEtud/:idModule returns 204",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Petit", prenom: "Hugo", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
await seedNotes([{ numEtud: s.numEtud, idModule: "M1", note: 9.0 }]);
|
||||
const res = await noteHandler.DELETE!(
|
||||
makeGetRequest(`/notes/${s.numEtud}/M1`),
|
||||
makeEmployeeContext({ numEtud: String(s.numEtud), idModule: "M1" }),
|
||||
);
|
||||
assertEquals(res.status, 204);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e notes: DELETE /notes/:numEtud/:idModule 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await noteHandler.DELETE!(
|
||||
makeGetRequest("/notes/99999/GHOST"),
|
||||
makeEmployeeContext({ numEtud: "99999", idModule: "GHOST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
@@ -0,0 +1,559 @@
|
||||
// Robustness tests — input validation & side-effect isolation
|
||||
//
|
||||
// Chaque test documente le comportement réel du handler face à des entrées invalides.
|
||||
// Les tests marqués [BUG] représentent le comportement ATTENDU — ils échouent
|
||||
// intentionnellement pour exposer un bug dans le handler ciblé.
|
||||
|
||||
import { assertEquals, assertRejects } from "@std/assert";
|
||||
import {
|
||||
makeContextWithAffiliation,
|
||||
makeEmployeeContext,
|
||||
makeGetRequest,
|
||||
makeJsonRequest,
|
||||
} from "../helpers/handler.ts";
|
||||
import {
|
||||
seedModules,
|
||||
seedPromotions,
|
||||
seedStudents,
|
||||
seedUes,
|
||||
truncateAll,
|
||||
} from "../helpers/db_integration.ts";
|
||||
import { handler as modulesHandler } from "$apps/admin/api/modules.ts";
|
||||
import { handler as moduleHandler } from "$apps/admin/api/modules/[idModule].ts";
|
||||
import { handler as notesHandler } from "$apps/notes/api/notes.ts";
|
||||
import { handler as uesHandler } from "$apps/notes/api/ues.ts";
|
||||
import { handler as ueModulesHandler } from "$apps/notes/api/ue-modules.ts";
|
||||
import { handler as ajustementsHandler } from "$apps/notes/api/ajustements.ts";
|
||||
import { handler as enseignementsHandler } from "$apps/admin/api/enseignements.ts";
|
||||
import { handler as usersHandler } from "$apps/admin/api/users.ts";
|
||||
|
||||
// Helper : request POST avec un body JSON invalide
|
||||
function makeMalformedRequest(path: string): Request {
|
||||
return new Request(`http://localhost${path}`, {
|
||||
method: "POST",
|
||||
headers: { "content-type": "application/json" },
|
||||
body: "{ ceci n'est pas du json }",
|
||||
});
|
||||
}
|
||||
|
||||
// Helper : request POST sans body du tout
|
||||
function makeEmptyBodyRequest(path: string, method = "POST"): Request {
|
||||
return new Request(`http://localhost${path}`, { method });
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// JSON MALFORMÉ
|
||||
// =============================================================================
|
||||
// Handlers AVEC try/catch → retournent 500
|
||||
// Handlers SANS try/catch → throwent (assertRejects)
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /notes malformed JSON → 500 (try/catch présent)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await notesHandler.POST!(
|
||||
makeMalformedRequest("/notes"),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 500);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /ues malformed JSON → 500 (try/catch présent)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await uesHandler.POST!(
|
||||
makeMalformedRequest("/ues"),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 500);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /ue-modules malformed JSON → 500 (try/catch présent)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueModulesHandler.POST!(
|
||||
makeMalformedRequest("/ue-modules"),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 500);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /ajustements malformed JSON → 500 (try/catch présent)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ajustementsHandler.POST!(
|
||||
makeMalformedRequest("/ajustements"),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 500);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// Handlers SANS try/catch — throwent au lieu de retourner 500
|
||||
// [BUG] Ces handlers devraient retourner 500, pas throw
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /modules malformed JSON → throw (pas de try/catch)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await assertRejects(() =>
|
||||
modulesHandler.POST!(
|
||||
makeMalformedRequest("/modules"),
|
||||
makeEmployeeContext(),
|
||||
)
|
||||
);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /enseignements malformed JSON → throw (pas de try/catch)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await assertRejects(() =>
|
||||
enseignementsHandler.POST!(
|
||||
makeMalformedRequest("/enseignements"),
|
||||
makeEmployeeContext(),
|
||||
)
|
||||
);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /users malformed JSON → throw (pas de try/catch)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await assertRejects(() =>
|
||||
usersHandler.POST!(
|
||||
makeMalformedRequest("/users"),
|
||||
makeEmployeeContext(),
|
||||
)
|
||||
);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// BODY ABSENT
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /notes sans body → 500",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await notesHandler.POST!(
|
||||
makeEmptyBodyRequest("/notes"),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 500);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /modules sans body → throw (pas de try/catch)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await assertRejects(() =>
|
||||
modulesHandler.POST!(
|
||||
makeEmptyBodyRequest("/modules"),
|
||||
makeEmployeeContext(),
|
||||
)
|
||||
);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// CHAÎNES VIDES — comportement correct ✓
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /modules id vide → 400",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await modulesHandler.POST!(
|
||||
makeJsonRequest("/modules", "POST", { id: "", nom: "Test" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /modules nom vide → 400",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await modulesHandler.POST!(
|
||||
makeJsonRequest("/modules", "POST", { id: "M1", nom: "" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /ues nom vide → 400",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await uesHandler.POST!(
|
||||
makeJsonRequest("/ues", "POST", { nom: "" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// CHAÎNES AVEC ESPACES SEULS — [BUG] passent !field et s'insèrent en DB
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /modules id=espaces → devrait être 400, retourne 201",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await modulesHandler.POST!(
|
||||
makeJsonRequest("/modules", "POST", { id: " ", nom: "Test" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
// Le handler vérifie !body.id → " " est truthy → passe → s'insère
|
||||
// Comportement attendu : 400
|
||||
// Comportement réel : 201 (bug : pas de trim())
|
||||
assertEquals(res.status, 400); // ← va échouer, expose le bug
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /ues nom=espaces → devrait être 400, retourne 201",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await uesHandler.POST!(
|
||||
makeJsonRequest("/ues", "POST", { nom: " " }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400); // ← va échouer, expose le bug
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /users id=espaces → devrait être 400, retourne 201",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await assertRejects(
|
||||
// sans try/catch + whitespace id → s'insère (ou throw si DB rejette)
|
||||
// Dans tous les cas le handler ne valide pas correctement
|
||||
async () => {
|
||||
const res = await usersHandler.POST!(
|
||||
makeJsonRequest("/users", "POST", { id: " ", nom: "X", prenom: "Y" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
// Si pas de throw : le handler a inséré des espaces en DB
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// MAUVAIS TYPES
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /notes note=string → devrait être 400, retourne 500",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Test", prenom: "User", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod" }]);
|
||||
const res = await notesHandler.POST!(
|
||||
makeJsonRequest("/notes", "POST", { note: "pas-un-nombre", numEtud: s.numEtud, idModule: "M1" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
// "pas-un-nombre" !== undefined → passe la validation → DB rejette → 500
|
||||
// Comportement attendu : 400 (validation de type)
|
||||
// Comportement réel : 500
|
||||
assertEquals(res.status, 400); // ← va échouer, expose le bug
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: PUT /modules/:id nom=number → devrait être 400, throw ou insère",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedModules([{ id: "M1", nom: "Mod" }]);
|
||||
await assertRejects(() =>
|
||||
moduleHandler.PUT!(
|
||||
makeJsonRequest("/modules/M1", "PUT", { nom: 42 }),
|
||||
makeEmployeeContext({ idModule: "M1" }),
|
||||
)
|
||||
);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// VALEUR ZÉRO — falsy bug sur numEtud/idUE
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /ajustements numEtud=0 → 400 pour mauvaise raison",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
const res = await ajustementsHandler.POST!(
|
||||
makeJsonRequest("/ajustements", "POST", { numEtud: 0, idUE: ue.id, valeur: 10.0 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
// !0 === true → retourne 400 à cause du falsy check, pas d'une vraie validation
|
||||
// Comportement attendu : 422 ou message d'erreur explicite sur numEtud invalide
|
||||
// Comportement réel : 400 générique "champs requis"
|
||||
assertEquals(res.status, 400); // passe, mais pour la mauvaise raison — le message est trompeur
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /ajustements idUE=0 → 400 pour mauvaise raison",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Test", prenom: "User", idPromo: "P1" }]);
|
||||
const res = await ajustementsHandler.POST!(
|
||||
makeJsonRequest("/ajustements", "POST", { numEtud: s.numEtud, idUE: 0, valeur: 10.0 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400); // !0 → 400, message trompeur
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// VALEUR ZÉRO CORRECTEMENT GÉRÉE — coeff=0 est valide
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /ue-modules coeff=0 → 201 (zéro est une valeur valide)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod" }]);
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
const res = await ueModulesHandler.POST!(
|
||||
makeJsonRequest("/ue-modules", "POST", { idModule: "M1", idUE: ue.id, idPromo: "P1", coeff: 0 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
// coeff === undefined → false pour 0 → passe ✓
|
||||
assertEquals(res.status, 201);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// INJECTION SQL DANS LES PARAMÈTRES D'URL
|
||||
// Drizzle utilise des requêtes paramétrées → les injections sont neutralisées
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: GET /modules avec SQL injection dans id → 404 (Drizzle paramètre)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const injectionId = "'; DROP TABLE modules; --";
|
||||
const res = await moduleHandler.GET!(
|
||||
makeGetRequest(`/modules/${encodeURIComponent(injectionId)}`),
|
||||
makeEmployeeContext({ idModule: injectionId }),
|
||||
);
|
||||
// Drizzle génère WHERE id = $1 avec $1 = "'; DROP TABLE modules; --"
|
||||
// Aucune injection possible → module non trouvé → 404
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /modules avec SQL injection dans id → s'insère littéralement (safe)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const injectionId = "'; DROP TABLE modules; --";
|
||||
const res = await modulesHandler.POST!(
|
||||
makeJsonRequest("/modules", "POST", { id: injectionId, nom: "Test" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
// Drizzle paramètre la valeur → s'insère comme une chaîne ordinaire → 201
|
||||
assertEquals(res.status, 201);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// ABSENCE DE VALIDATION MÉTIER — valeurs hors limites acceptées
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /notes note > 20 → devrait être 400, retourne 201",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Test", prenom: "User", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod" }]);
|
||||
const res = await notesHandler.POST!(
|
||||
makeJsonRequest("/notes", "POST", { note: 999, numEtud: s.numEtud, idModule: "M1" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
// Aucune validation de borne → 999 s'insère → 201
|
||||
assertEquals(res.status, 400); // ← va échouer, expose le manque de validation métier
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /notes note < 0 → devrait être 400, retourne 201",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
const [s] = await seedStudents([{ nom: "Test", prenom: "User", idPromo: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod" }]);
|
||||
const res = await notesHandler.POST!(
|
||||
makeJsonRequest("/notes", "POST", { note: -5, numEtud: s.numEtud, idModule: "M1" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400); // ← va échouer
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness [BUG]: POST /ue-modules coeff négatif → devrait être 400, retourne 201",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod" }]);
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
const res = await ueModulesHandler.POST!(
|
||||
makeJsonRequest("/ue-modules", "POST", { idModule: "M1", idUE: ue.id, idPromo: "P1", coeff: -3 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400); // ← va échouer
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// ISOLATION DES EFFETS DE BORD
|
||||
// Vérification que truncateAll() isole correctement chaque test
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: isolation — données du test précédent non visibles",
|
||||
async fn() {
|
||||
// Ce test crée un module
|
||||
await truncateAll();
|
||||
await modulesHandler.POST!(
|
||||
makeJsonRequest("/modules", "POST", { id: "ISOLATION-TEST", nom: "Test" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: isolation — truncateAll efface bien les données du test précédent",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
// Le module créé dans le test précédent ne doit plus exister
|
||||
const res = await moduleHandler.GET!(
|
||||
makeGetRequest("/modules/ISOLATION-TEST"),
|
||||
makeEmployeeContext({ idModule: "ISOLATION-TEST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// CHAMPS SUPPLÉMENTAIRES INCONNUS — doivent être ignorés silencieusement
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /modules avec champs inconnus → 201 (champs ignorés)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await modulesHandler.POST!(
|
||||
makeJsonRequest("/modules", "POST", {
|
||||
id: "M-EXTRA",
|
||||
nom: "Test",
|
||||
champInconnu: "valeur",
|
||||
_admin: true,
|
||||
__proto__: { polluted: true },
|
||||
}),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 201);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// =============================================================================
|
||||
// ACCÈS NON AUTHENTIFIÉ — vérification que l'état auth est bien contrôlé
|
||||
// =============================================================================
|
||||
|
||||
Deno.test({
|
||||
name: "robustness: POST /modules sans affiliation employee → 403",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
for (const role of ["student", "alumni", "", "EMPLOYEE", "admin"]) {
|
||||
const res = await modulesHandler.POST!(
|
||||
makeJsonRequest("/modules", "POST", { id: `M-${role}`, nom: "Test" }),
|
||||
makeContextWithAffiliation(role),
|
||||
);
|
||||
assertEquals(res.status, 403, `role "${role}" devrait être 403`);
|
||||
}
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
@@ -0,0 +1,271 @@
|
||||
// E2E tests for /ue-modules endpoints — handler + real DB
|
||||
|
||||
import { assertEquals, assertExists } from "@std/assert";
|
||||
import {
|
||||
makeContextWithAffiliation,
|
||||
makeEmployeeContext,
|
||||
makeGetRequest,
|
||||
makeJsonRequest,
|
||||
} from "../helpers/handler.ts";
|
||||
import {
|
||||
seedModules,
|
||||
seedPromotions,
|
||||
seedUeModules,
|
||||
seedUes,
|
||||
truncateAll,
|
||||
} from "../helpers/db_integration.ts";
|
||||
import { handler as ueModulesHandler } from "$apps/notes/api/ue-modules.ts";
|
||||
import { handler as ueModuleHandler } from "$apps/notes/api/ue-modules/[idModule]/[idUE]/[idPromo].ts";
|
||||
import { ueModules as ueModulesTable } from "$root/databases/schema.ts";
|
||||
import { testDb } from "../helpers/db_integration.ts";
|
||||
|
||||
// --- GET /ue-modules ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: GET /ue-modules returns all associations",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }, { id: "M2", nom: "Mod B" }]);
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
await seedUeModules([
|
||||
{ idModule: "M1", idUE: ue.id, idPromo: "P1", coeff: 2.0 },
|
||||
{ idModule: "M2", idUE: ue.id, idPromo: "P1", coeff: 3.0 },
|
||||
]);
|
||||
const res = await ueModulesHandler.GET!(makeGetRequest("/ue-modules"), makeEmployeeContext());
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 2);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: GET /ue-modules?idPromo filters by promo",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }, { id: "P2" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
await seedUeModules([
|
||||
{ idModule: "M1", idUE: ue.id, idPromo: "P1", coeff: 2.0 },
|
||||
{ idModule: "M1", idUE: ue.id, idPromo: "P2", coeff: 3.0 },
|
||||
]);
|
||||
const res = await ueModulesHandler.GET!(
|
||||
makeGetRequest("/ue-modules", { idPromo: "P1" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 1);
|
||||
assertEquals(body[0].idPromo, "P1");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- POST /ue-modules ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: POST /ue-modules creates association (201)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
const [ue] = await seedUes([{ nom: "UE Info" }]);
|
||||
const res = await ueModulesHandler.POST!(
|
||||
makeJsonRequest("/ue-modules", "POST", { idModule: "M1", idUE: ue.id, idPromo: "P1", coeff: 4.0 }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 201);
|
||||
const body = await res.json();
|
||||
assertExists(body.idModule);
|
||||
assertEquals(body.coeff, 4.0);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: POST /ue-modules 400 on missing fields",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueModulesHandler.POST!(
|
||||
makeJsonRequest("/ue-modules", "POST", { idModule: "M1" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- GET /ue-modules/:idModule/:idUE/:idPromo ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: GET /ue-modules/:idModule/:idUE/:idPromo returns correct association (employee)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }, { id: "P2" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }, { id: "M2", nom: "Mod B" }]);
|
||||
const [ue1, ue2] = await seedUes([{ nom: "UE Info" }, { nom: "UE Maths" }]);
|
||||
// Plusieurs lignes qui partagent idModule="M1" — le handler doit discriminer par idUE ET idPromo
|
||||
await seedUeModules([
|
||||
{ idModule: "M1", idUE: ue1.id, idPromo: "P1", coeff: 3.5 },
|
||||
{ idModule: "M1", idUE: ue2.id, idPromo: "P1", coeff: 1.0 },
|
||||
{ idModule: "M1", idUE: ue1.id, idPromo: "P2", coeff: 2.0 },
|
||||
{ idModule: "M2", idUE: ue1.id, idPromo: "P1", coeff: 4.0 },
|
||||
]);
|
||||
const res = await ueModuleHandler.GET!(
|
||||
makeGetRequest(`/ue-modules/M1/${ue1.id}/P1`),
|
||||
makeEmployeeContext({ idModule: "M1", idUE: String(ue1.id), idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
// Doit retourner exactement M1/ue1/P1 avec coeff 3.5, pas une autre ligne
|
||||
assertEquals(body.coeff, 3.5);
|
||||
assertEquals(body.idPromo, "P1");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: GET /ue-modules/:idModule/:idUE/:idPromo 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueModuleHandler.GET!(
|
||||
makeGetRequest("/ue-modules/M1/1/P1"),
|
||||
makeContextWithAffiliation("student", { idModule: "M1", idUE: "1", idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: GET /ue-modules/:idModule/:idUE/:idPromo 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueModuleHandler.GET!(
|
||||
makeGetRequest("/ue-modules/GHOST/1/GHOST"),
|
||||
makeEmployeeContext({ idModule: "GHOST", idUE: "1", idPromo: "GHOST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- PUT /ue-modules/:idModule/:idUE/:idPromo ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: PUT /ue-modules/:idModule/:idUE/:idPromo updates only the targeted row (employee)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }, { id: "P2" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
const [ue1, ue2] = await seedUes([{ nom: "UE Info" }, { nom: "UE Maths" }]);
|
||||
// Deux lignes avec même idModule — le PUT ne doit modifier que celle ciblée
|
||||
await seedUeModules([
|
||||
{ idModule: "M1", idUE: ue1.id, idPromo: "P1", coeff: 2.0 },
|
||||
{ idModule: "M1", idUE: ue2.id, idPromo: "P2", coeff: 9.0 },
|
||||
]);
|
||||
const res = await ueModuleHandler.PUT!(
|
||||
makeJsonRequest(`/ue-modules/M1/${ue1.id}/P1`, "PUT", { coeff: 5.0 }),
|
||||
makeEmployeeContext({ idModule: "M1", idUE: String(ue1.id), idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.coeff, 5.0);
|
||||
assertEquals(body.idPromo, "P1");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: PUT /ue-modules/:idModule/:idUE/:idPromo 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueModuleHandler.PUT!(
|
||||
makeJsonRequest("/ue-modules/M1/1/P1", "PUT", { coeff: 5.0 }),
|
||||
makeContextWithAffiliation("student", { idModule: "M1", idUE: "1", idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: PUT /ue-modules/:idModule/:idUE/:idPromo 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueModuleHandler.PUT!(
|
||||
makeJsonRequest("/ue-modules/GHOST/1/GHOST", "PUT", { coeff: 5.0 }),
|
||||
makeEmployeeContext({ idModule: "GHOST", idUE: "1", idPromo: "GHOST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- DELETE /ue-modules/:idModule/:idUE/:idPromo ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: DELETE /ue-modules/:idModule/:idUE/:idPromo deletes only targeted row (employee)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedPromotions([{ id: "P1" }, { id: "P2" }]);
|
||||
await seedModules([{ id: "M1", nom: "Mod A" }]);
|
||||
const [ue1, ue2] = await seedUes([{ nom: "UE Info" }, { nom: "UE Maths" }]);
|
||||
// Deux lignes avec même idModule — seule celle ciblée doit être supprimée
|
||||
await seedUeModules([
|
||||
{ idModule: "M1", idUE: ue1.id, idPromo: "P1", coeff: 2.0 },
|
||||
{ idModule: "M1", idUE: ue2.id, idPromo: "P2", coeff: 4.0 },
|
||||
]);
|
||||
const res = await ueModuleHandler.DELETE!(
|
||||
makeGetRequest(`/ue-modules/M1/${ue1.id}/P1`),
|
||||
makeEmployeeContext({ idModule: "M1", idUE: String(ue1.id), idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 204);
|
||||
// L'autre ligne doit toujours exister
|
||||
const remaining = await testDb.select().from(ueModulesTable);
|
||||
assertEquals(remaining.length, 1);
|
||||
assertEquals(remaining[0].idUE, ue2.id);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: DELETE /ue-modules/:idModule/:idUE/:idPromo 403 for non-employee",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueModuleHandler.DELETE!(
|
||||
makeGetRequest("/ue-modules/M1/1/P1"),
|
||||
makeContextWithAffiliation("student", { idModule: "M1", idUE: "1", idPromo: "P1" }),
|
||||
);
|
||||
assertEquals(res.status, 403);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ue_modules: DELETE /ue-modules/:idModule/:idUE/:idPromo 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueModuleHandler.DELETE!(
|
||||
makeGetRequest("/ue-modules/GHOST/1/GHOST"),
|
||||
makeEmployeeContext({ idModule: "GHOST", idUE: "1", idPromo: "GHOST" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
@@ -0,0 +1,170 @@
|
||||
// E2E tests for /ues endpoints — handler + real DB
|
||||
|
||||
import { assertEquals, assertExists } from "@std/assert";
|
||||
import {
|
||||
makeEmployeeContext,
|
||||
makeGetRequest,
|
||||
makeJsonRequest,
|
||||
} from "../helpers/handler.ts";
|
||||
import { seedUes, truncateAll } from "../helpers/db_integration.ts";
|
||||
import { handler as uesHandler } from "$apps/notes/api/ues.ts";
|
||||
import { handler as ueHandler } from "$apps/notes/api/ues/[idUE].ts";
|
||||
|
||||
// --- GET /ues ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: GET /ues returns all UEs",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUes([{ nom: "UE Informatique" }, { nom: "UE Mathématiques" }]);
|
||||
const res = await uesHandler.GET!(makeGetRequest("/ues"), makeEmployeeContext());
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 2);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: GET /ues returns empty when no UEs",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await uesHandler.GET!(makeGetRequest("/ues"), makeEmployeeContext());
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 0);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- POST /ues ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: POST /ues creates UE (201)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await uesHandler.POST!(
|
||||
makeJsonRequest("/ues", "POST", { nom: "UE Physique" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 201);
|
||||
const body = await res.json();
|
||||
assertExists(body.id);
|
||||
assertEquals(body.nom, "UE Physique");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: POST /ues 400 on missing nom",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await uesHandler.POST!(
|
||||
makeJsonRequest("/ues", "POST", {}),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- GET /ues/:id ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: GET /ues/:id returns UE",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const [ue] = await seedUes([{ nom: "UE Chimie" }]);
|
||||
const res = await ueHandler.GET!(
|
||||
makeGetRequest(`/ues/${ue.id}`),
|
||||
makeEmployeeContext({ idUE: String(ue.id) }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.nom, "UE Chimie");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: GET /ues/:id 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueHandler.GET!(
|
||||
makeGetRequest("/ues/99999"),
|
||||
makeEmployeeContext({ idUE: "99999" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- PUT /ues/:id ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: PUT /ues/:id updates nom",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const [ue] = await seedUes([{ nom: "UE Biologie" }]);
|
||||
const res = await ueHandler.PUT!(
|
||||
makeJsonRequest(`/ues/${ue.id}`, "PUT", { nom: "UE Biologie moléculaire" }),
|
||||
makeEmployeeContext({ idUE: String(ue.id) }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.nom, "UE Biologie moléculaire");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: PUT /ues/:id 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueHandler.PUT!(
|
||||
makeJsonRequest("/ues/99999", "PUT", { nom: "X" }),
|
||||
makeEmployeeContext({ idUE: "99999" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- DELETE /ues/:id ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: DELETE /ues/:id returns 204",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const [ue] = await seedUes([{ nom: "UE à supprimer" }]);
|
||||
const res = await ueHandler.DELETE!(
|
||||
makeGetRequest(`/ues/${ue.id}`),
|
||||
makeEmployeeContext({ idUE: String(ue.id) }),
|
||||
);
|
||||
assertEquals(res.status, 204);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e ues: DELETE /ues/:id 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await ueHandler.DELETE!(
|
||||
makeGetRequest("/ues/99999"),
|
||||
makeEmployeeContext({ idUE: "99999" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
@@ -0,0 +1,217 @@
|
||||
// E2E tests for /users endpoints — handler + real DB
|
||||
|
||||
import { assertEquals, assertExists } from "@std/assert";
|
||||
import {
|
||||
makeEmployeeContext,
|
||||
makeGetRequest,
|
||||
makeJsonRequest,
|
||||
} from "../helpers/handler.ts";
|
||||
import {
|
||||
seedRoles,
|
||||
seedUsers,
|
||||
truncateAll,
|
||||
} from "../helpers/db_integration.ts";
|
||||
import { handler as usersHandler } from "$apps/admin/api/users.ts";
|
||||
import { handler as userHandler } from "$apps/admin/api/users/[id].ts";
|
||||
|
||||
// --- GET /users ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: GET /users returns all users",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([
|
||||
{ id: "dupont.jean", nom: "Dupont", prenom: "Jean" },
|
||||
{ id: "martin.alice", nom: "Martin", prenom: "Alice" },
|
||||
]);
|
||||
const res = await usersHandler.GET!(makeGetRequest("/users"), makeEmployeeContext());
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 2);
|
||||
assertExists(body.find((u: { id: string }) => u.id === "dupont.jean"));
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: GET /users returns empty when no users",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await usersHandler.GET!(makeGetRequest("/users"), makeEmployeeContext());
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 0);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: GET /users?idRole filters by role",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const [role1] = await seedRoles([{ nom: "admin" }]);
|
||||
const [role2] = await seedRoles([{ nom: "employee" }]);
|
||||
await seedUsers([
|
||||
{ id: "admin.user", nom: "Admin", prenom: "User", idRole: role1.id },
|
||||
{ id: "emp.user", nom: "Emp", prenom: "User", idRole: role2.id },
|
||||
]);
|
||||
const res = await usersHandler.GET!(
|
||||
makeGetRequest("/users", { idRole: String(role1.id) }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.length, 1);
|
||||
assertEquals(body[0].id, "admin.user");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- POST /users ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: POST /users creates user (201)",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await usersHandler.POST!(
|
||||
makeJsonRequest("/users", "POST", { id: "new.user", nom: "New", prenom: "User" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 201);
|
||||
const body = await res.json();
|
||||
assertEquals(body.id, "new.user");
|
||||
assertEquals(body.nom, "New");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: POST /users 400 on missing fields",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await usersHandler.POST!(
|
||||
makeJsonRequest("/users", "POST", { id: "x" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 400);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: POST /users 409 on duplicate id",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([{ id: "dupont.jean", nom: "Dupont", prenom: "Jean" }]);
|
||||
const res = await usersHandler.POST!(
|
||||
makeJsonRequest("/users", "POST", { id: "dupont.jean", nom: "Doublon", prenom: "X" }),
|
||||
makeEmployeeContext(),
|
||||
);
|
||||
assertEquals(res.status, 409);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- GET /users/:id ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: GET /users/:id returns user",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([{ id: "bernard.lucie", nom: "Bernard", prenom: "Lucie" }]);
|
||||
const res = await userHandler.GET!(
|
||||
makeGetRequest("/users/bernard.lucie"),
|
||||
makeEmployeeContext({ id: "bernard.lucie" }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.id, "bernard.lucie");
|
||||
assertEquals(body.nom, "Bernard");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: GET /users/:id 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await userHandler.GET!(
|
||||
makeGetRequest("/users/ghost.user"),
|
||||
makeEmployeeContext({ id: "ghost.user" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- PUT /users/:id ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: PUT /users/:id updates user",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([{ id: "thomas.eva", nom: "Thomas", prenom: "Eva" }]);
|
||||
const res = await userHandler.PUT!(
|
||||
makeJsonRequest("/users/thomas.eva", "PUT", { nom: "Thomas-Modifié", prenom: "Eva", idRole: null }),
|
||||
makeEmployeeContext({ id: "thomas.eva" }),
|
||||
);
|
||||
assertEquals(res.status, 200);
|
||||
const body = await res.json();
|
||||
assertEquals(body.nom, "Thomas-Modifié");
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: PUT /users/:id 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await userHandler.PUT!(
|
||||
makeJsonRequest("/users/ghost.user", "PUT", { nom: "X", prenom: "Y", idRole: null }),
|
||||
makeEmployeeContext({ id: "ghost.user" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
// --- DELETE /users/:id ---
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: DELETE /users/:id returns 204",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
await seedUsers([{ id: "petit.hugo", nom: "Petit", prenom: "Hugo" }]);
|
||||
const res = await userHandler.DELETE!(
|
||||
makeGetRequest("/users/petit.hugo"),
|
||||
makeEmployeeContext({ id: "petit.hugo" }),
|
||||
);
|
||||
assertEquals(res.status, 204);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
|
||||
Deno.test({
|
||||
name: "e2e users: DELETE /users/:id 404 when not found",
|
||||
async fn() {
|
||||
await truncateAll();
|
||||
const res = await userHandler.DELETE!(
|
||||
makeGetRequest("/users/ghost.user"),
|
||||
makeEmployeeContext({ id: "ghost.user" }),
|
||||
);
|
||||
assertEquals(res.status, 404);
|
||||
},
|
||||
sanitizeResources: false,
|
||||
sanitizeOps: false,
|
||||
});
|
||||
Reference in New Issue
Block a user